WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Fixes for good spots by IMHLv2

Browse Source
This commit is contained in:
Mike Auty
2020-08-26 20:36:52 +01:00
committed by ikelos
parent 5bc6c4a33b
commit 89b466c8ac
6 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/dlllist.py
+7 -7
View File
@@ -34,17 +34,17 @@ class DllList(interfaces.plugins.PluginInterface):
description = "Process IDs to include (all other processes are excluded)",
optional = True),
requirements.BooleanRequirement(name = 'dump',
description = "Extract listed processes",
description = "Extract listed DLLs",
default = False,
optional = True)
]
@classmethod
def dump_dll(cls,
context: interfaces.context.ContextInterface,
pe_table_name: str,
dll_entry: interfaces.objects.ObjectInterface,
layer_name: str = None) -> interfaces.plugins.FileInterface:
def dump_pe(cls,
context: interfaces.context.ContextInterface,
pe_table_name: str,
dll_entry: interfaces.objects.ObjectInterface,
layer_name: str = None) -> interfaces.plugins.FileInterface:
"""Extracts the complete data for a process as a FileInterface
Args:
@@ -103,7 +103,7 @@ class DllList(interfaces.plugins.PluginInterface):
dumped = False
if self.config['dump']:
filedata = self.dump_dll(self.context, pe_table_name, entry, proc_layer_name)
filedata = self.dump_pe(self.context, pe_table_name, entry, proc_layer_name)
if filedata:
filedata.preferred_filename = "pid.{0}.".format(proc_id) + filedata.preferred_filename
dumped = True
volatility/framework/plugins/windows/memmap.py
-2
View File
@@ -71,8 +71,6 @@ class Memmap(interfaces.plugins.PluginInterface):
dumped))
offset += mapped_size
import pdb
pdb.set_trace()
self.produce_file(filedata)
def run(self):
volatility/framework/plugins/windows/modscan.py
+1 -1
View File
@@ -76,7 +76,7 @@ class ModScan(interfaces.plugins.PluginInterface):
dumped = False
if self.config['dump']:
filedata = dlllist.DllList.dump_dll(self.context, pe_table_name, mod)
filedata = dlllist.DllList.dump_pe(self.context, pe_table_name, mod)
if filedata:
self.produce_file(filedata)
dumped = True
volatility/framework/plugins/windows/modules.py
+1 -1
View File
@@ -57,7 +57,7 @@ class Modules(interfaces.plugins.PluginInterface):
dumped = False
if self.config['dump']:
filedata = dlllist.DllList.dump_dll(self.context, pe_table_name, mod)
filedata = dlllist.DllList.dump_pe(self.context, pe_table_name, mod)
if filedata:
self.produce_file(filedata)
dumped = True
volatility/framework/plugins/windows/registry/hivelist.py
+1 -1
View File
@@ -53,7 +53,7 @@ class HiveList(interfaces.plugins.PluginInterface):
default = None),
requirements.PluginRequirement(name = 'hivescan', plugin = hivescan.HiveScan, version = (1, 0, 0)),
requirements.BooleanRequirement(name = 'dump',
description = "Extract listed processes",
description = "Extract listed registry hives",
default = False,
optional = True)
volatility/framework/plugins/windows/vadinfo.py
+1 -1
View File
@@ -58,7 +58,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
optional = True),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.BooleanRequirement(name = 'dump',
description = "Extract listed processes",
description = "Extract listed memory ranges",
default = False,
optional = True)
]